Start an order
Root cause analysis / Investigation

copilot.microsoft.com

Reference RCA-CAA5C3B507B47584

Microsoft Chat website

Measurement point: Stealth NYC, 32 Avenue of the Americas.

Published investigation. Updates run automatically.

01 / Network path

Network path.

Endpoint measurements / ICMP IPv4

Latency over time.

Successful endpoint RTT recordings from up to one hour before and after the event. Points are sampled from the retained history.

Enter time range

Times use the selected timezone; choices include recorded samples and intervals across the available chart.

Use the recordings table below to view latency values.
Successful RTT recording Event interval

05 Nov 2026 13:55 – 05 Nov 2026 22:19 UTC. Hover or tap to inspect; drag across the chart to zoom. On touchscreens, first choose Select time range. Escape or Reset zoom restores the full range. Missing recordings are gaps; this is not an application availability or packet-loss chart.

Select a recording to explore nearby path observations.

View recorded values
Successful ICMP IPv4 RTT recordings; displayed points are a sample of the retained records.
Recorded at (UTC)RTT
1.406 ms
1.439 ms
1.004 ms
1.044 ms
2.620 ms
1.194 ms
0.984 ms
1.033 ms
0.997 ms
0.961 ms
1.023 ms
17.335 ms
18.867 ms
6.500 ms
1.410 ms
20.346 ms
15.238 ms
14.691 ms
5.324 ms
0.981 ms
1.357 ms
0.965 ms
16.119 ms
16.791 ms
15.006 ms
1.446 ms
1.501 ms
0.954 ms
1.373 ms
3.605 ms
1.034 ms
0.961 ms
1.419 ms
2.097 ms
1.384 ms
0.958 ms
0.964 ms
0.998 ms
2.525 ms
1.340 ms
1.102 ms
0.984 ms
1.413 ms
0.999 ms
1.445 ms
1.083 ms
1.378 ms
1.493 ms
1.020 ms
1.014 ms
0.980 ms
1.390 ms
0.980 ms
17.287 ms
0.983 ms
0.965 ms
1.057 ms
1.384 ms
0.979 ms
1.403 ms
0.974 ms
1.351 ms
1.381 ms
1.012 ms
0.960 ms
1.380 ms
1.135 ms
1.328 ms
1.014 ms
2.388 ms
1.039 ms
1.433 ms
1.020 ms
16.794 ms
1.426 ms
7.333 ms
0.993 ms
1.040 ms
7.001 ms
0.997 ms
1.051 ms
1.428 ms
1.509 ms
1.006 ms
1.010 ms
0.980 ms
13.485 ms
0.968 ms
1.056 ms
1.468 ms
1.154 ms
1.025 ms
2.456 ms
1.004 ms
0.983 ms
1.082 ms
0.976 ms
1.064 ms
1.014 ms
1.395 ms
1.379 ms
19.203 ms
1.031 ms
1.043 ms
1.382 ms
1.396 ms
0.996 ms
1.019 ms
0.998 ms
1.392 ms
1.123 ms
1.018 ms
1.024 ms
1.410 ms
1.025 ms
0.947 ms
1.019 ms
1.422 ms
1.394 ms
1.024 ms
1.042 ms
1.429 ms
1.855 ms
1.410 ms
4.467 ms
0.992 ms
1.051 ms
1.091 ms
1.033 ms
0.992 ms
16.206 ms
1.099 ms
18.622 ms
0.989 ms
18.429 ms
0.974 ms
0.992 ms
16.066 ms
1.103 ms
1.038 ms
16.217 ms
20.763 ms
0.959 ms
13.731 ms
14.143 ms
1.003 ms
1.018 ms
16.771 ms
14.184 ms
0.996 ms
4.784 ms
1.210 ms
16.355 ms
1.432 ms
1.381 ms
1.004 ms
13.669 ms
0.985 ms
1.524 ms
1.028 ms
11.476 ms
20.416 ms
1.475 ms
1.060 ms
0.993 ms
1.046 ms
4.246 ms
16.809 ms
1.362 ms
1.395 ms
0.969 ms
1.035 ms
0.993 ms
1.022 ms
0.990 ms
17.834 ms
0.998 ms
16.715 ms
15.272 ms
15.997 ms
1.179 ms
0.994 ms
12.293 ms
11.764 ms
1.101 ms
0.987 ms
0.962 ms
1.684 ms
3.917 ms
16.898 ms
0.976 ms
0.989 ms
0.992 ms
1.377 ms
1.380 ms
0.974 ms
1.053 ms
0.974 ms
0.992 ms
0.999 ms
3.082 ms
0.985 ms
1.095 ms
1.034 ms
1.040 ms
10.062 ms
1.009 ms
1.400 ms
1.166 ms
0.985 ms
0.989 ms
1.042 ms
1.452 ms
0.960 ms
0.959 ms
0.976 ms
1.340 ms
1.032 ms
1.348 ms
1.096 ms
1.042 ms
1.077 ms
0.975 ms
1.348 ms
1.021 ms
1.414 ms
5.742 ms
1.030 ms
1.605 ms
1.228 ms
1.371 ms
0.958 ms
0.952 ms
0.973 ms
12.917 ms
1.071 ms
1.000 ms
1.387 ms
0.997 ms
0.993 ms
0.970 ms
1.368 ms
1.488 ms
1.389 ms
1.710 ms
1.370 ms
1.080 ms
0.988 ms
1.017 ms
0.969 ms
1.007 ms
1.442 ms
1.015 ms
1.398 ms
1.082 ms
20.045 ms
0.978 ms
1.062 ms
1.383 ms
0.977 ms
1.002 ms
0.989 ms
1.093 ms
1.164 ms
1.404 ms
1.394 ms
1.411 ms
1.383 ms
1.424 ms
1.028 ms
1.408 ms
1.386 ms
1.019 ms
1.013 ms
9.746 ms
1.062 ms
0.971 ms
1.368 ms
1.116 ms
1.063 ms
1.475 ms
18.119 ms
1.230 ms
1.002 ms
1.437 ms
0.959 ms
1.390 ms
19.820 ms
1.058 ms
1.029 ms
1.345 ms
1.015 ms
1.457 ms
1.405 ms
1.383 ms
1.382 ms
1.316 ms
10.631 ms
1.280 ms
0.951 ms
0.997 ms
1.370 ms
1.426 ms
1.380 ms
1.387 ms
2.970 ms
0.949 ms
0.931 ms
1.373 ms
1.384 ms
1.362 ms
1.052 ms
0.998 ms
8.279 ms
1.060 ms
0.975 ms
0.973 ms
1.395 ms
0.932 ms
0.975 ms
4.403 ms
0.994 ms
1.403 ms
1.015 ms
1.351 ms
1.012 ms
1.009 ms
1.378 ms
1.352 ms
0.982 ms
1.385 ms
1.418 ms
1.444 ms
1.381 ms
1.012 ms
1.471 ms
0.996 ms
13.030 ms
1.356 ms
1.058 ms
1.459 ms
1.037 ms
1.859 ms
1.032 ms
6.184 ms
0.944 ms
1.229 ms
1.365 ms
0.984 ms
1.008 ms
1.407 ms
0.999 ms
1.398 ms
1.360 ms
1.402 ms
1.008 ms
13.528 ms
18.635 ms
1.074 ms
Network path / recorded observations

Network path observations.

17 observations

Choose a measurement type to see the closest of the available sampled observations to the selected chart point. Each probe is separate and may follow a different path.

Before

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.137 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.186 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop20.888 msReply RTT AS13335 · Cloudflare
Before

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.174 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.188 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop19.154 msReply RTT AS13335 · Cloudflare
  4. TTL 4 Probe hop21.102 msReply RTT AS13335 · Cloudflare
  5. TTL 5 Probe hop3.379 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.253 msReply RTT AS13335 · Cloudflare
Before

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.132 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.182 msReply RTT AS8002 · Stealth
Before

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.362 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.188 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop1.477 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.386 msReply RTT AS13335 · Cloudflare
Before

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.151 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.197 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop1.249 msReply RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop2.318 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.057 msReply RTT AS13335 · Cloudflare
During

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.119 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.192 msReply RTT AS8002 · Stealth
During

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.186 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.236 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop1.566 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.364 msReply RTT AS13335 · Cloudflare
During

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.135 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.195 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop14.920 msReply RTT AS13335 · Cloudflare
During

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.144 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.173 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop4.686 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Probe hopNo replyNo comparable RTT ASN unavailable
  7. TTL 7 Destination2.004 msReply RTT AS13335 · Cloudflare
During

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.119 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.180 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop1.149 msReply RTT AS13335 · Cloudflare
During

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.168 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.274 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop15.279 msReply RTT AS13335 · Cloudflare
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop2.083 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.153 msReply RTT AS13335 · Cloudflare
After

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.127 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.179 msReply RTT AS8002 · Stealth
After

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.234 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.355 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop1.432 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.405 msReply RTT AS13335 · Cloudflare
After

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.191 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.183 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop7.120 msReply RTT AS13335 · Cloudflare
After

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.148 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.186 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop1.147 msReply RTT AS13335 · Cloudflare
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop1.889 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Probe hopNo replyNo comparable RTT ASN unavailable
  7. TTL 7 Destination1.841 msReply RTT AS13335 · Cloudflare
After

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.144 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.182 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop17.595 msReply RTT AS13335 · Cloudflare
After

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.149 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.197 msReply RTT AS8002 · Stealth
  3. TTL 3 Probe hop1.231 msReply RTT AS13335 · Cloudflare
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hop1.717 msReply RTT AS13335 · Cloudflare
  6. TTL 6 Destination1.043 msReply RTT AS13335 · Cloudflare

RTT is the round trip to each responding hop, not the delay of the preceding link. TTL order may omit routers and does not prove direct links. A missing reply is not proof of packet loss. ASN labels are dated address associations; they do not establish the forwarding path or the operator at the event time. Up to three recorded traces per method and period are selected across the archive. Where no individual trace is available, a comparison may summarize a window; MTR observations aggregate multiple probes. Address aliases are independent across measurement types.

Same method / same recorded address

Compare the traces.

Compare one selected trace from before the event with one during it. Values are individual replies, not a statistical comparison.

ICMP traceroute · Recorded address 1

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.137 msAS8002 · Stealth0.119 msAS8002 · StealthSame responder
20.186 msAS8002 · Stealth0.180 msAS8002 · StealthSame responder
320.888 msAS13335 · Cloudflare1.149 msAS13335 · CloudflareSame responder
ICMP traceroute · Recorded address 2

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.132 msAS8002 · Stealth0.119 msAS8002 · StealthSame responder
20.182 msAS8002 · Stealth0.192 msAS8002 · StealthSame responder
TCP traceroute / 443 · Recorded address 1

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.151 msAS8002 · Stealth0.144 msAS8002 · StealthSame responder
20.197 msAS8002 · Stealth0.173 msAS8002 · StealthSame responder
31.249 msNo replyNot established
4No replyNo replyNot established
52.318 msAS13335 · Cloudflare4.686 msAS13335 · CloudflareDifferent responders
61.057 msAS13335 · CloudflareNo replyNot established
7Not recorded2.004 msAS13335 · CloudflareNot established
TCP traceroute / 443 · Recorded address 2

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.362 msAS8002 · Stealth0.186 msAS8002 · StealthSame responder
20.188 msAS8002 · Stealth0.236 msAS8002 · StealthSame responder
3No replyNo replyNot established
4No replyNo replyNot established
51.477 msAS13335 · Cloudflare1.566 msAS13335 · CloudflareDifferent responders
61.386 msAS13335 · Cloudflare1.364 msAS13335 · CloudflareSame responder

RTTs include the return path. Different responders, missing replies and independent probe flows limit what a change can localize. MTR snapshots remain separate in the replay.

Event timeline.

Possible SLA event. Times shown are UTC.

Event opened
UTC
Last event observation
UTC
Recovery observed
UTC

Recorded recovery describes this event, not current reachability.

02 / Assessment

Assessment.

Investigation stateRecovered
Path assessment

Elevated latency observed.

Endpoint round-trip time was elevated during part of the event. The available path observations do not identify where the increase occurred.

What we observed

  • A sustained increase in measured round trip time was observed.
  • Stored traces were compared using matching source and destination addresses.

Recording counts describe collected measurements, not application availability or packet loss. Exact packet paths and the return path remain unverified.

Measurements at a glance.

Baseline RTT1.085 msUsual round trip before the event
Last recorded event RTT0.993 msLast successful event recording
Event p95 RTT17.802 ms95th percentile of successful recordings
Change from baseline-0.093 msLast event RTT compared with the baseline
Successful / expected recordings758 / 770Recorded endpoint samples during the event

RTT is round trip time; p95 describes the upper range of successful recordings. Endpoint measurements differ from individual trace replies and are not an uptime percentage.

Record sources and timestamps
Analysis updated
UTC
Public snapshot published
UTC
Public observation window
– UTC

Event and source timestamps are UTC. The latency chart uses its selected timezone. Page refresh times are separate from measurement timestamps.

03 / Method and limits

Method and limits.

How to interpret the sampled path and its limits

Corroborating the path.

Comparisons use matching destinations before and during the event. ICMP traces use echo probes. TCP/443 traces send SYN probes to port 443 only; they do not complete a TCP handshake or perform a TLS or HTTP exchange.

The Stealth gNMI interface verifies the active route-table choice and maps its primary next hop to the Stealth logical interface, configured attachment and, where applicable, the known LAG member set at each snapshot. Stable Stealth replies, together with mapped interface evidence showing no corresponding errors or sustained capacity pressure, reduce the likelihood of a Stealth forwarding issue. An 80% load warning warrants investigation; it does not prove congestion. Lower interval averages can conceal bursts or queue pressure. Optical readings assess the physical link, not congestion.

What remains unseen.

Probe reply handling can differ from packet forwarding. A slow intermediate reply that disappears at later hops does not locate a forwarding problem. A destination that does not respond to a trace is not thereby shown to be unavailable.

Stealth does not use ECMP in this monitored scope. The route snapshot does not identify which physical LAG member carried a particular independent probe, attest line-card forwarding at that packet instant, prove the exact application packet flow or observe the return path. RTT includes the return path, which may differ. No remote reverse traceroute is available. Tunnels and silent routers may hide parts of the path. Address registration alone does not establish the forwarding operator or responsibility.

References: ICMP reply handling / RFC 1812 · Round trip measurements / RFC 2681 · Full methodology